payment-kit 1.29.1 → 1.29.2

package/api/src/routes/exchange-rates.ts

@@ -1,87 +0,0 @@
-import { Router } from 'express';
-
-import { getExchangeRateService } from '../libs/exchange-rate/service';
-import { getExchangeRateSymbol, hasTokenAddress } from '../libs/exchange-rate/token-address-mapping';
-import { authenticate } from '../libs/security';
-import { ChainType, PaymentCurrency, PaymentMethod } from '../store/models';
-
-const router = Router();
-const auth = authenticate({ component: true, roles: ['owner', 'admin'], ensureLogin: true });
-const exchangeRateService = getExchangeRateService();
-
-/**
- * Validate if exchange rate can be fetched for a currency
- * This is used during price creation/editing to validate the base currency
- */
-router.post('/validate', auth, async (req, res) => {
-  try {
-    const { currency: currencyId } = req.body;
-
-    if (!currencyId) {
-      return res.status(400).json({ error: 'currency is required' });
-    }
-
-    const paymentCurrency = (await PaymentCurrency.findByPk(currencyId, {
-      include: [
-        {
-          model: PaymentMethod,
-          as: 'payment_method',
-        },
-      ],
-    })) as PaymentCurrency & { payment_method: PaymentMethod };
-
-    if (!paymentCurrency) {
-      return res.status(400).json({ error: 'Currency not found' });
-    }
-
-    if (paymentCurrency.payment_method?.type === 'stripe') {
-      return res.status(400).json({
-        error: `Currency ${paymentCurrency.symbol} is not supported.`,
-        supported: false,
-      });
-    }
-
-    // Check if token has address mapping
-    if (!hasTokenAddress(paymentCurrency.symbol, paymentCurrency.payment_method?.type as ChainType)) {
-      return res.status(400).json({
-        error: `Currency ${paymentCurrency.symbol} is not supported.`,
-        supported: false,
-      });
-    }
-
-    // Try to fetch exchange rate
-    try {
-      const rateSymbol = getExchangeRateSymbol(
-        paymentCurrency.symbol,
-        paymentCurrency.payment_method?.type as ChainType
-      );
-      const rateResult = await exchangeRateService.getRate(rateSymbol);
-
-      // Return full rate info consistent with checkout-sessions exchange-rate endpoint
-      return res.json({
-        supported: true,
-        currency: paymentCurrency.symbol,
-        base_currency: 'USD',
-        rate: rateResult.rate,
-        timestamp_ms: rateResult.timestamp_ms,
-        fetched_at: rateResult.fetched_at,
-        provider_id: rateResult.provider_id,
-        provider_name: rateResult.provider_name,
-        provider_display: rateResult.provider_display,
-        providers: rateResult.providers,
-        consensus_method: rateResult.consensus_method,
-        degraded: rateResult.degraded,
-        degraded_reason: rateResult.degraded_reason,
-      });
-    } catch (error: any) {
-      return res.status(400).json({
-        error: `Failed to fetch exchange rate for ${paymentCurrency.symbol}: ${error.message}`,
-        supported: false,
-      });
-    }
-  } catch (error: any) {
-    return res.status(400).json({ error: error.message });
-  }
-});
-
-export default router;

package/api/src/routes/index.ts

@@ -1,142 +0,0 @@
-import { Router } from 'express';
-
-import { PaymentCurrency } from '../store/models/payment-currency';
-import autoRechargeConfigs from './auto-recharge-configs';
-import checkoutSessions from './checkout-sessions';
-import coupons from './coupons';
-import creditGrants from './credit-grants';
-import creditTokens from './credit-tokens';
-import creditTransactions from './credit-transactions';
-import customers from './customers';
-import donations from './donations';
-import events from './events';
-import entitlements from './entitlements';
-import appStore from './integrations/app-store';
-import googlePlay from './integrations/google-play';
-import stripe from './integrations/stripe';
-import invoices from './invoices';
-import meterEvents from './meter-events';
-import taxRates from './tax-rates';
-import meters from './meters';
-import passports from './passports';
-import paymentCurrencies from './payment-currencies';
-import paymentIntents from './payment-intents';
-import paymentLinks from './payment-links';
-import paymentMethods from './payment-methods';
-import paymentStats from './payment-stats';
-import payouts from './payouts';
-import prices from './prices';
-import pricingTables from './pricing-table';
-import products from './products';
-import promotionCodes from './promotion-codes';
-import redirect from './redirect';
-import refunds from './refunds';
-import exchangeRateProviders from './exchange-rate-providers';
-import exchangeRates from './exchange-rates';
-import settings from './settings';
-import subscriptionItems from './subscription-items';
-import subscriptions from './subscriptions';
-import usageRecords from './usage-records';
-import webhookAttempts from './webhook-attempts';
-import webhookEndpoints from './webhook-endpoints';
-import vendor from './vendor';
-import tool from './tool';
-import archive from './archive';
-
-const router = Router();
-
-router.use((req, _, next) => {
-  if (req.query.livemode) {
-    try {
-      req.livemode = !!JSON.parse(String(req.query.livemode));
-    } catch {
-      req.livemode = true;
-    }
-  } else if (typeof req.livemode !== 'boolean') {
-    // CF Workers' createExpressReq pre-populates req.livemode from the worker's
-    // PAYMENT_LIVEMODE env var; honor that when set. Express dev has no
-    // upstream, so we fall back to the env var ourselves — defaulting to
-    // livemode=true unless explicitly disabled via PAYMENT_LIVEMODE=false.
-    req.livemode = process.env.PAYMENT_LIVEMODE !== 'false';
-  }
-
-  next();
-});
-
-// Lazy-load base currency with TTL cache to avoid DB query on every request
-const baseCurrencyCache = new Map<string, { data: any; expires: number }>();
-const BASE_CURRENCY_TTL = 5 * 60_000; // 5 minutes (invalidated on model update)
-
-// Lazily register hooks after models are initialized (avoid top-level addHook before Sequelize init)
-let baseCurrencyHooksRegistered = false;
-function ensureBaseCurrencyHooks() {
-  if (baseCurrencyHooksRegistered) return;
-  baseCurrencyHooksRegistered = true;
-  PaymentCurrency.addHook('afterUpdate', 'invalidateBaseCurrencyCache', () => {
-    baseCurrencyCache.clear();
-  });
-  PaymentCurrency.addHook('afterDestroy', 'invalidateBaseCurrencyCacheOnDelete', () => {
-    baseCurrencyCache.clear();
-  });
-}
-
-// Base currency middleware — only needed by routes that use req.currency
-// (checkout-sessions, donations, payment-links, prices, products)
-const loadBaseCurrency = async (req: any, _: any, next: any) => {
-  ensureBaseCurrencyHooks();
-  const key = `base_${req.livemode}`;
-  const cached = baseCurrencyCache.get(key);
-  if (cached && cached.expires > Date.now()) {
-    req.baseCurrency = cached.data;
-  } else {
-    req.baseCurrency = await PaymentCurrency.findOne({ where: { is_base_currency: true, livemode: req.livemode } });
-    if (req.baseCurrency) {
-      baseCurrencyCache.set(key, { data: req.baseCurrency, expires: Date.now() + BASE_CURRENCY_TTL });
-    }
-  }
-  next();
-};
-
-router.use('/auto-recharge-configs', autoRechargeConfigs);
-router.use('/checkout-sessions', loadBaseCurrency, checkoutSessions);
-router.use('/coupons', coupons);
-router.use('/credit-grants', creditGrants);
-router.use('/credit-tokens', creditTokens);
-router.use('/credit-transactions', creditTransactions);
-router.use('/customers', customers);
-router.use('/donations', loadBaseCurrency, donations);
-router.use('/events', events);
-router.use('/invoices', invoices);
-router.use('/integrations/stripe', stripe);
-router.use('/integrations/google-play', googlePlay);
-router.use('/integrations/app-store', appStore);
-router.use('/entitlements', entitlements);
-router.use('/meter-events', meterEvents);
-router.use('/meters', meters);
-router.use('/passports', passports);
-router.use('/payment-intents', paymentIntents);
-router.use('/payment-links', loadBaseCurrency, paymentLinks);
-router.use('/payment-methods', paymentMethods);
-router.use('/payment-currencies', paymentCurrencies);
-router.use('/payment-stats', paymentStats);
-router.use('/prices', loadBaseCurrency, prices);
-router.use('/pricing-tables', pricingTables);
-router.use('/tax-rates', taxRates);
-router.use('/products', loadBaseCurrency, products);
-router.use('/promotion-codes', promotionCodes);
-router.use('/exchange-rate-providers', exchangeRateProviders);
-router.use('/exchange-rates', exchangeRates);
-router.use('/payouts', payouts);
-router.use('/redirect', redirect);
-router.use('/refunds', refunds);
-router.use('/settings', settings);
-router.use('/subscription-items', subscriptionItems);
-router.use('/subscriptions', subscriptions);
-router.use('/usage-records', usageRecords);
-router.use('/webhook-attempts', webhookAttempts);
-router.use('/webhook-endpoints', webhookEndpoints);
-router.use('/vendors', vendor);
-router.use('/tool', tool);
-router.use('/archive', archive);
-
-export default router;

package/api/src/routes/integrations/stripe.ts

@@ -1,61 +0,0 @@
-import { env } from '@blocklet/sdk/lib/env';
-import express, { NextFunction, Request, Response, Router } from 'express';
-import get from 'lodash/get';
-
-import handleStripeEvent from '../../integrations/stripe/handlers';
-import logger from '../../libs/logger';
-import { STRIPE_EVENTS } from '../../libs/util';
-import { PaymentMethod } from '../../store/models';
-
-const router = Router();
-
-const verifyWebhookSig = async (req: Request, res: Response, next: NextFunction) => {
-  try {
-    const signature = req.get('stripe-signature');
-    if (!signature) {
-      return res.status(400).json({ error: 'No stripe webhook signature found' });
-    }
-
-    const json = JSON.parse(req.body.toString('utf8'));
-    const method = await PaymentMethod.findOne({ where: { type: 'stripe', livemode: json.livemode } });
-    if (!method) {
-      return res.status(400).json({ error: 'No stripe payment method found' });
-    }
-
-    const stripe = method.getStripeClient();
-    const settings = PaymentMethod.decryptSettings(method.settings);
-    const secret = process.env.STRIPE_WEBHOOK_SECRET || settings.stripe?.webhook_signing_secret;
-    req.stripeEvent = stripe.webhooks.constructEvent(req.body, signature, secret as string);
-    req.stripeClient = stripe;
-
-    return next();
-  } catch (err) {
-    logger.error('verify signature error', { error: err });
-    return res.status(400).json({ error: err.message });
-  }
-};
-
-const handleEvent = async (req: Request, res: Response) => {
-  const { stripeEvent, stripeClient } = req;
-
-  if (STRIPE_EVENTS.includes(stripeEvent.type) === false) {
-    logger.debug('webhook event not interested', { id: stripeEvent.id, type: stripeEvent.type });
-    return res.json({ skipped: true });
-  }
-
-  // only events from this app should be processed
-  const appPid = get(stripeEvent, 'data.object.metadata.appPid');
-  if (appPid && appPid !== env.appPid) {
-    logger.debug('webhook event for other app', { id: stripeEvent.id, type: stripeEvent.type });
-    return res.json({ skipped: true });
-  }
-
-  logger.debug('webhook received event', { id: stripeEvent.id, type: stripeEvent.type });
-  await handleStripeEvent(stripeEvent, stripeClient);
-
-  return res.json({ received: true });
-};
-
-router.post('/webhook', express.raw({ type: 'application/json' }), verifyWebhookSig, handleEvent);
-
-export default router;

package/api/src/routes/meters.ts

@@ -1,274 +0,0 @@
-import { Router } from 'express';
-import Joi from 'joi';
-import pick from 'lodash/pick';
-
-import { Op } from 'sequelize';
-import { createListParamSchema, getOrder, getWhereFromKvQuery, MetadataSchema } from '../libs/api';
-import logger from '../libs/logger';
-import { authenticate } from '../libs/security';
-import { formatMetadata } from '../libs/util';
-import { Meter, PaymentCurrency, PaymentMethod } from '../store/models';
-
-const router = Router();
-const auth = authenticate<Meter>({ component: true, roles: ['owner', 'admin'] });
-
-const meterSchema = Joi.object({
-  name: Joi.string().max(64).required(),
-  event_name: Joi.string().max(64).required(),
-  aggregation_method: Joi.string().valid('sum', 'count', 'last').default('sum'),
-  unit: Joi.string().max(32).required(),
-  currency_id: Joi.string().max(40).optional(),
-  decimal: Joi.number().integer().min(2).max(18).default(10),
-  description: Joi.string().max(255).allow('').optional(),
-  metadata: MetadataSchema,
-  component_did: Joi.string().max(40).optional(),
-  token: Joi.object({
-    tokenFactoryAddress: Joi.string().required(),
-  }).optional(),
-}).unknown(true);
-
-const updateMeterSchema = Joi.object({
-  name: Joi.string().max(64).optional(),
-  description: Joi.string().max(255).allow('').optional(),
-  status: Joi.string().valid('active', 'inactive').optional(),
-});
-
-const listSchema = createListParamSchema<{ event_name?: string }>({
-  event_name: Joi.string().empty(''),
-});
-
-router.get('/', auth, async (req, res) => {
-  try {
-    const { page, pageSize, ...query } = await listSchema.validateAsync(req.query, { stripUnknown: true });
-    const where = getWhereFromKvQuery(query.q);
-
-    if (typeof query.livemode === 'boolean') {
-      where.livemode = query.livemode;
-    }
-    if (query.event_name) {
-      where.event_name = query.event_name;
-    }
-
-    const { rows: list, count } = await Meter.findAndCountAll({
-      where,
-      order: getOrder(query, [['created_at', query.o === 'asc' ? 'ASC' : 'DESC']]),
-      offset: (page - 1) * pageSize,
-      limit: pageSize,
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-
-    res.json({ count, list, paging: { page, pageSize } });
-  } catch (err) {
-    logger.error('Error listing meters', err);
-    res.status(400).json({ error: err?.message });
-  }
-});
-
-router.post('/', auth, async (req, res) => {
-  try {
-    const { error } = meterSchema.validate(req.body);
-    if (error) {
-      return res.status(400).json({ error: `Meter create request invalid: ${error.message}` });
-    }
-
-    const existing = await Meter.findOne({
-      where: { event_name: req.body.event_name },
-    });
-    if (existing) {
-      return res.status(409).json({ error: `Meter with event_name "${req.body.event_name}" already exists` });
-    }
-
-    if (['count', 'last'].includes(req.body.aggregation_method)) {
-      return res.status(400).json({ error: 'Aggregation method is not supported' });
-    }
-
-    const needArcblockMethod = req.body.token?.tokenFactoryAddress || !req.body.currency_id;
-    const arcblockMethod = needArcblockMethod
-      ? await PaymentMethod.findOne({ where: { livemode: !!req.livemode, type: 'arcblock' } })
-      : null;
-    if (needArcblockMethod && !arcblockMethod) {
-      throw new Error('ArcBlock payment method not found');
-    }
-
-    let tokenConfig: Record<string, any> | undefined;
-    if (req.body.token?.tokenFactoryAddress) {
-      const client = arcblockMethod!.getOcapClient();
-      const { state: tokenFactoryState } = await client.getTokenFactoryState({
-        address: req.body.token.tokenFactoryAddress,
-      });
-      if (!tokenFactoryState) {
-        return res.status(400).json({ error: 'Token factory not found on chain' });
-      }
-      tokenConfig = {
-        address: tokenFactoryState.token.address,
-        symbol: tokenFactoryState.token.symbol,
-        name: tokenFactoryState.token.name,
-        decimal: tokenFactoryState.token.decimal,
-        token_factory_address: tokenFactoryState.address,
-      };
-    }
-
-    const meterData = {
-      ...pick(req.body, ['name', 'event_name', 'aggregation_method', 'unit', 'currency_id', 'description', 'metadata']),
-      livemode: !!req.livemode,
-      created_via: req.user?.via || 'api',
-      status: req.body.status || 'active',
-      metadata: formatMetadata(req.body.metadata),
-    };
-
-    if (!meterData.currency_id) {
-      const paymentCurrency = await PaymentCurrency.createForMeter(meterData, arcblockMethod!.id, tokenConfig, {
-        decimal: req.body.decimal,
-      });
-      meterData.currency_id = paymentCurrency.id;
-    }
-
-    const meter = await Meter.create(meterData);
-
-    const result = await Meter.findByPk(meter.id, {
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-
-    logger.info('Meter created', { meterId: meter.id, eventName: meter.event_name });
-    return res.json(result);
-  } catch (err) {
-    logger.error('create meter failed', { error: err?.message, request: req.body });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-// Public endpoint: only returns safe fields, no auth required
-const PUBLIC_METER_FIELDS = ['id', 'name', 'event_name', 'status', 'unit', 'description', 'currency_id'] as const;
-
-router.get('/public/:id', async (req, res) => {
-  try {
-    const meter = await Meter.findOne({
-      where: {
-        [Op.or]: [{ id: req.params.id }, { event_name: req.params.id }],
-      },
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-
-    if (!meter) {
-      return res.status(404).json({ error: 'Meter not found' });
-    }
-
-    return res.json({
-      ...pick(meter.toJSON(), PUBLIC_METER_FIELDS),
-      paymentCurrency: (meter as any).paymentCurrency
-        ? pick((meter as any).paymentCurrency.toJSON(), ['id', 'name', 'symbol', 'decimal', 'logo', 'type'])
-        : null,
-    });
-  } catch (err) {
-    logger.error('get public meter failed', { error: err?.message, meterId: req.params.id });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-router.get('/:id', auth, async (req, res) => {
-  try {
-    const meter = await Meter.findOne({
-      where: {
-        [Op.or]: [{ id: req.params.id }, { event_name: req.params.id }],
-      },
-      include: [{ model: PaymentCurrency.scope('withRechargeConfig'), as: 'paymentCurrency' }],
-    });
-
-    if (!meter) {
-      return res.status(404).json({ error: 'Meter not found' });
-    }
-
-    return res.json(meter);
-  } catch (err) {
-    logger.error('get meter failed', { error: err?.message, meterId: req.params.id });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-router.put('/:id', auth, async (req, res) => {
-  try {
-    const { error } = updateMeterSchema.validate(pick(req.body, ['name', 'description', 'status']));
-    if (error) {
-      return res.status(400).json({ error: `Meter update request invalid: ${error.message}` });
-    }
-
-    const meter = await Meter.findByPk(req.params.id, {
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-    if (!meter) {
-      return res.status(404).json({ error: 'Meter not found' });
-    }
-
-    const updateData: any = {
-      ...pick(req.body, ['name', 'description', 'status']),
-      unit: req.body.unit || meter.unit,
-      updated_by: req.user?.did,
-    };
-
-    if (req.body.metadata) {
-      const { error: metadataError } = MetadataSchema.validate(req.body.metadata);
-      if (metadataError) {
-        return res.status(400).json({ error: `metadata invalid: ${metadataError.message}` });
-      }
-      updateData.metadata = formatMetadata(req.body.metadata);
-    }
-
-    await meter.update(updateData);
-
-    return res.json(meter);
-  } catch (err) {
-    logger.error('update meter failed', { error: err?.message, meterId: req.params.id });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-router.put('/:id/activate', auth, async (req, res) => {
-  try {
-    const meter = await Meter.findByPk(req.params.id, {
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-    if (!meter) {
-      return res.status(404).json({ error: 'Meter not found' });
-    }
-
-    if (meter.status === 'active') {
-      return res.status(400).json({ error: 'Meter is already active' });
-    }
-
-    await meter.update({
-      status: 'active',
-      updated_by: req.user?.did,
-    });
-    return res.json(meter);
-  } catch (err) {
-    logger.error('activate meter failed', { error: err?.message, meterId: req.params.id });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-router.put('/:id/deactivate', auth, async (req, res) => {
-  try {
-    const meter = await Meter.findByPk(req.params.id, {
-      include: [{ model: PaymentCurrency, as: 'paymentCurrency' }],
-    });
-    if (!meter) {
-      return res.status(404).json({ error: 'Meter not found' });
-    }
-
-    if (meter.status === 'inactive') {
-      return res.status(400).json({ error: 'Meter is already inactive' });
-    }
-
-    await meter.update({
-      status: 'inactive',
-      updated_by: req.user?.did,
-    });
-
-    return res.json(meter);
-  } catch (err) {
-    logger.error('deactivate meter failed', { error: err?.message, meterId: req.params.id });
-    return res.status(400).json({ error: err?.message });
-  }
-});
-
-export default router;

package/api/src/routes/passports.ts

@@ -1,68 +0,0 @@
-import { Router } from 'express';
-
-import { updatePassportExtra } from '../integrations/blocklet/passport';
-import { blocklet } from '../libs/auth';
-import { authenticate } from '../libs/security';
-import { PaymentLink, PricingTable, Product } from '../store/models';
-
-const router = Router();
-const auth = authenticate<any>({ component: false, roles: ['owner', 'admin'] });
-
-router.get('/', auth, async (_, res) => {
-  const result = await blocklet.getRoles();
-  res.json(result.roles);
-});
-
-router.put('/assign', auth, async (req, res) => {
-  const { name, id } = req.body;
-
-  if (!id) {
-    return res.status(400).json({ message: 'payment entry or product id is required' });
-  }
-  if (!name) {
-    return res.status(400).json({ message: 'passport name is required' });
-  }
-
-  if (id.startsWith('plink_')) {
-    const doc = await PaymentLink.findByPk(id);
-    if (!doc?.active) {
-      return res.status(400).json({ message: 'payment link is not active' });
-    }
-
-    const result = await updatePassportExtra(name, { acquire: { pay: id } });
-    return res.json(result);
-  }
-
-  if (id.startsWith('prctbl_')) {
-    const doc = await PricingTable.findByPk(id);
-    if (!doc?.active) {
-      return res.status(400).json({ message: 'pricing table is not active' });
-    }
-
-    const result = await updatePassportExtra(name, { acquire: { pay: id } });
-    return res.json(result);
-  }
-
-  if (id.startsWith('prod_')) {
-    const doc = await Product.findByPk(id);
-    if (!doc?.active) {
-      return res.status(400).json({ message: 'product is not active' });
-    }
-
-    await doc.update({ metadata: { ...doc.metadata, passport: name } });
-    const result = await updatePassportExtra(name, { payment: { product: id } });
-    return res.json(result);
-  }
-
-  return res.status(400).json({ message: 'pay link is not support' });
-});
-
-router.delete('/assign/:name', auth, async (req, res) => {
-  const result = await updatePassportExtra(req.params.name as string, {
-    payment: { product: '' },
-    acquire: { pay: '' },
-  });
-  return res.json(result);
-});
-
-export default router;

package/api/src/routes/redirect.ts

@@ -1,20 +0,0 @@
-import qs from 'querystring';
-
-import { getUrl } from '@blocklet/sdk/lib/component';
-import { Router } from 'express';
-
-const router = Router();
-
-router.get('/checkout/:entryId', (req, res) => {
-  const { entryId } = req.params;
-  if (entryId.startsWith('plink_')) {
-    return res.redirect(getUrl(`/checkout/pay/${entryId}?${qs.stringify(req.query as any)}`));
-  }
-  if (entryId.startsWith('prctbl_')) {
-    return res.redirect(getUrl(`/checkout/pricing-table/${entryId}?${qs.stringify(req.query as any)}`));
-  }
-
-  return res.redirect(getUrl('/'));
-});
-
-export default router;